Limit the number of nodes created from anonymous users

Question

I am in the process of finishing the development of a small appointment scheduling system, just using node creation as an appointment. Anonymous users can thus make appointments via a node creation form.

In order to slightly limit the ease of spamming from a malicious person, I would have liked to know if it was possible to limit the number of nodes created by an anonymous user. I am well aware that it is not very effective security, but the objective is simply to limit the damage.

I found an extremely close answer to my question on Limit amount of content creation per anonymous user.

/**
 * Implements hook_node_access
 */
function MY_MODULE_node_access($node, $op, $account) {

    // Get node type, can be string or node object
    $type = is_string($node) ? $node : $node->type;
    if ($type == 'type_of_interest') {
      // Check flood limit for anon users node creation
      if ($op == 'create' && user_is_anonymous()) {
        // Ensure checked only once per page request, node/add path only
        $access_checked = &drupal_static(__FUNCTION__);
        if(empty($access_checked) && arg(0) == 'node' && arg(1) == 'add') {
          // Record the access check for drupal_static
          $access_checked = TRUE;
          // Check create_node limit of 2 per 12 hours
          // Note, you could make the threshold and window config variables.
          if(!flood_is_allowed('create_node', 2, 43200)){
            drupal_set_message(t('There is a node creation limit of 2 nodes per 12 hours. Please try again later.'), 'error');
            return NODE_ACCESS_DENY;
          }else{
            // Register the node create event to test against for 48 hours
            // Note, you could move this somewhere else to ensure the node is actually saved, e.g hook_node_insert
            flood_register_event('create_node', 172800);
          }
        }
      }
    }

  return NODE_ACCESS_IGNORE;

}

Unfortunately, this is a code block for Drupal 7.

Would the code be similar for Drupal 8?
I am not very used to programming with Drupal 8.

Answer 1

Drupal 8 invokes a specific hook when an entity is created: hook_entity_create_access(). Apart that, Drupal 8 code has been converted to a more OOP code, and it uses methods where before it used functions.

The following code is the one I would use for Drupal 8.

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Session\AccountInterface;

/**
 * Implements hook_ENTITY_TYPE_create_access().
 */
function mymodule_node_create_access(AccountInterface $account, array $context, $entity_bundle) {
  $flood = \Drupal::flood();
  if ($entity_bundle == 'type_of_interest' && $account->isAnonymous()) {
    if (!$flood->isAllowed('create_node', 2, 43200)) {
      return AccessResult::forbidden('There is a node creation limit of 2 nodes per 12 hours.');
    } 
    $flood->register('create_node', 43200);
  }
  return AccessResult::neutral();
}

Answer 2

You can try the Entity Limit module. I've used it in the past. I believe you can set the number of nodes created with the anonymous user role. You can install it with

composer require drupal/entity_limit

And then enable the module.

As of this writing, its not available for Drupal 9 though.

https://www.drupal.org/project/entity_limit